How I’ve Solved My Agentic Identity Problem

All it took was new account with its own digital signature

I maintain several important open-source digital forensics projects, and I’ve started using AI to clean up the codebase. It’s important for me to distinguish the code I’ve written from code written by AI. The good news is that I’ve come up with a simple way to distinguish the two: I gave my agent its own GitHub account.

My GitHub account is @simsong — https://github.com/simsong

My agent’s GitHub account is @simsong-codex — https://github.com/simsong-codex.

Dig my agent’s cool-but-creepy user photo. The agent made it all by itself with the prompt “make a nice icon for your github account.”

Here’s what my agent wrote: “The emblem combines a robotic owl, open book, and code brackets without borrowing an existing brand mark.”

A few months ago, one of my users filed bug report #497: “a lot errors and issues.” That’s it. It wasn’t very useful.

Motivated by this, I had the agent analyze the entire codebase and come up with a list of existing technical debt—the kinds of problems that worsen over time and make a large codebase slower and harder to maintain. The agent identified three “priority 0” issues that had to be addressed and seven priority 1 issues. This list superseded the original bug report #497. I gave the agent sample data on which to run the program and told it to systematically go through my code, create GitHub issues for each high-priority technical-debt item, and start solving them. Each time it completes one, the agent opens a pull request on GitHub from its own account, and runs the program’s self-tests to make sure it has not changed the program’s intended behavior.

My agent then waits for GitHub Copilot to do its own code review. It then reads Copilot’s report and makes any changes that Copilot recommends. I find that having one agent review another’s work is a clever way to catch subtle AI-introduced bugs.

When Codex and Copilot are finally in agreement and all of the tests pass, my agent marks the code as ready to review. I manually review it and, if it’s good enough, I merge the pull request and the Codex code is incorporated into my program’s codebase.

The pull requests are almost always perfect. Sometimes I object, and Codex either fixes the code or explains why I am mistaken.

This process has been working pretty well. Over the next month, I plan to dramatically improve the code quality and performance of this open-source digital forensics tool. Then I will probably start adding features that some of my users have requested.

This straightforward approach to improving code quality and performance is now being repeated at many organizations. Few, however, are conducting their development in public. For example, Microsoft’s July 2026 Windows release fixed almost three times as many security vulnerabilities as its June release. The surge coincided with Microsoft’s expanding use of AI to find Windows vulnerabilities, although public reporting does not establish how much AI contributed.

Like many people using AI-assisted software development, I’m finding that I’ve been dramatically more productive in recent months. But I’ve also learned that without the application of solid engineering principles, the AI-generated code becomes increasingly difficult to understand and maintain. Giving my agent its own GitHub account is my effort to make the agent work as a member of the team, rather than as an invisible collaborator.